public inbox for gcc-cvs@sourceware.org
help / color / mirror / Atom feed
* [gcc r13-360] [Ada] Add ghost code to facilitate proof with SPARK
@ 2022-05-12 12:41 Pierre-Marie de Rodat
0 siblings, 0 replies; only message in thread
From: Pierre-Marie de Rodat @ 2022-05-12 12:41 UTC (permalink / raw)
To: gcc-cvs
https://gcc.gnu.org/g:86c7b1617f0ae0da828d1107795f57c96c848d8f
commit r13-360-g86c7b1617f0ae0da828d1107795f57c96c848d8f
Author: Yannick Moy <moy@adacore.com>
Date: Thu Feb 10 11:54:44 2022 +0100
[Ada] Add ghost code to facilitate proof with SPARK
Proof of generic units for Long_Long_Long_Unsigned instantiations is
harder for provers, as they have to deal with larger values. Add ghost
code to make the proof easier.
gcc/ada/
* libgnat/s-imageu.adb (Set_Image_Unsigned): Add lemma.
* libgnat/s-valueu.adb (Scan_Raw_Unsigned): Add assertion.
Diff:
---
gcc/ada/libgnat/s-imageu.adb | 13 +++++++++++++
gcc/ada/libgnat/s-valueu.adb | 4 ++++
2 files changed, 17 insertions(+)
diff --git a/gcc/ada/libgnat/s-imageu.adb b/gcc/ada/libgnat/s-imageu.adb
index 87830dff740..d6d9d466091 100644
--- a/gcc/ada/libgnat/s-imageu.adb
+++ b/gcc/ada/libgnat/s-imageu.adb
@@ -210,6 +210,15 @@ package body System.Image_U is
-- Ghost lemma to prove the value of a character corresponding to the
-- next figure.
+ procedure Prove_Euclidian (Val, Quot, Rest : Uns)
+ with
+ Ghost,
+ Pre => Quot = Val / 10
+ and then Rest = Val rem 10,
+ Post => Val = 10 * Quot + Rest;
+ -- Ghost lemma to prove the relation between the quotient/remainder of
+ -- division by 10 and the initial value.
+
procedure Prove_Hexa_To_Unsigned_Ghost (R : Uns)
with
Ghost,
@@ -256,6 +265,7 @@ package body System.Image_U is
-----------------------------
procedure Prove_Character_Val (R : Uns) is null;
+ procedure Prove_Euclidian (Val, Quot, Rest : Uns) is null;
procedure Prove_Hexa_To_Unsigned_Ghost (R : Uns) is null;
procedure Prove_Unchanged is null;
@@ -347,6 +357,9 @@ package body System.Image_U is
Acc => Value);
if J /= Nb_Digits then
+ Prove_Euclidian (Val => Prev_Value,
+ Quot => Value,
+ Rest => Hexa_To_Unsigned_Ghost (S (P + J)));
pragma Assert
(Prev_Value = 10 * Value + Hexa_To_Unsigned_Ghost (S (P + J)));
Prove_Iter_Scan
diff --git a/gcc/ada/libgnat/s-valueu.adb b/gcc/ada/libgnat/s-valueu.adb
index f1456a1a5ca..461d957b1cb 100644
--- a/gcc/ada/libgnat/s-valueu.adb
+++ b/gcc/ada/libgnat/s-valueu.adb
@@ -590,6 +590,10 @@ package body System.Value_U is
if Str (P) = Base_Char then
Ptr.all := P + 1;
pragma Assert (Ptr.all = Last_Num_Based + 2);
+ pragma Assert
+ (if not Overflow then
+ Based_Val = Scan_Based_Number_Ghost
+ (Str, P, Last_Num_Based, Base, Uval));
Lemma_End_Of_Scan (Str, P, Last_Num_Based, Base, Uval);
pragma Assert (if not Overflow then Uval = Based_Val.Value);
exit;
^ permalink raw reply [flat|nested] only message in thread
only message in thread, other threads:[~2022-05-12 12:41 UTC | newest]
Thread overview: (only message) (download: mbox.gz / follow: Atom feed)
-- links below jump to the message on this page --
2022-05-12 12:41 [gcc r13-360] [Ada] Add ghost code to facilitate proof with SPARK Pierre-Marie de Rodat
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).